UCSAT
Get the app

Privacy Policy

Effective date: November 4, 2026 · Last updated: November 4, 2026

The short version

  • We collect what we need to run your account and your SAT practice: your name and email, your goal and test date, your answers and your progress. We don't track your location and we don't use advertising trackers.
  • Subscriptions are paid through Apple or Google. We never see your card.
  • Face ID stays on your phone. We never receive your face data.
  • We use AI to help our team write practice questions and explanations. It doesn't receive your personal information.
  • We don't sell your personal information.
  • You can see and change your details in the app, delete your account there, or email privacy@ucsat.com for anything else.

1. Who we are

Clevers LLC ("UCSAT", "we", "us") runs UCSAT, an app for preparing for the SAT: our mobile apps and our website (https://www.ucsat.com) (together, the "Service"). This policy explains how we handle personal information about the students who use the Service.

We're the controller of the personal information described here.

SAT® is a trademark registered by the College Board, which is not affiliated with, and does not endorse, UCSAT.

2. Information we collect

Information you give us

  • Account: your full name, email address and password (stored only as a one-way hash). A mobile phone number, profile photo, language and time zone if you add them. If you sign in with Apple, Google or Facebook, we get an account identifier, your name and the email address (or Apple relay address) they share.
  • Your goal: the school you're aiming for, the SAT date you're planning to take and your target score.
  • Your studying: your answers to practice questions, lesson checks, skill quizzes, domain reviews and practice tests, how long you spent on them, the lessons you finished, and the progress we work out from them (how well you know each SAT skill).
  • Parents you invite: if you choose to share weekly progress with a parent or guardian, the email address you enter for them. They only receive anything after they confirm by email, and they or you can stop it at any time.
  • Support: what you write to us and anything you attach.

Information about your subscription

You buy a subscription through the App Store (Apple) or Google Play (Google), which take your payment; we never see your card or bank details. They tell us which plan you bought, when it started, renews or ends, whether it was cancelled or refunded, the country of the store and a transaction reference.

Information collected automatically

  • Sign-in and security: one-time codes we send (only a hashed version), your sessions (when and how you signed in, IP address, device and app version), sign-in attempts, and a log of security-related actions. A sign-in from a new device asks you to confirm it's you with a code sent to your email. We don't turn your IP address into a location.
  • Device: the device model, operating system, app version, a random install identifier and, if you allow notifications, a push notification token.
  • Face ID and fingerprint: if you turn on unlocking with Face ID (or your fingerprint), your phone checks it. The app only learns whether the check passed; your biometric data never leaves your phone and we never receive it.
  • How you use the app: in-app events such as screens opened and features used, only if you agree to it in the app, to see what to improve. You can turn this off at any time.
  • Logs and error reports: the requests the app makes to our servers, the IP address they come from, and reports of crashes and errors, used to run, fix and secure the Service.

Information from Google when you use Sign in with Google

If you choose Sign in with Google, Google shares with us only your basic profile, through the standard "openid", "email" and "profile" permissions:

  • your Google account identifier;
  • your name;
  • your email address, and whether Google has verified it.

We don't ask for, and don't receive, access to your Gmail, Google Drive, Calendar, contacts or any other Google data.

How we use it: only to create your UCSAT account, to sign you in, and to show your name and email in your account. We don't use it for advertising, we don't sell it, and we don't use it to build profiles of you.

How we store and protect it: it is stored with your account on our servers in Google Cloud, encrypted in transit and at rest; your email address is also encrypted in our database.

Who it's shared with: no one, except our hosting provider (Google Cloud) who stores it for us, or where the law requires it (section 4). People on our team don't read it except to help you when you ask, for security, or when the law requires it.

How long we keep it and how to delete it: for as long as you have an account. Delete your account in the app (Profile → Privacy & security → Delete account) and we delete it as described in section 6. You can also remove UCSAT's access at any time at myaccount.google.com/permissions.

UCSAT's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Sign in with Apple and Facebook work the same way: we receive only an account identifier, your name and the email address (or Apple's private relay address) they share, and use it only to create your account and sign you in.

What we don't collect

We don't collect your device's location, your contacts, or health information, and the apps don't contain advertising trackers.

What we do Information used Legal basis (EEA/UK)
Create and run your account; sign you in; keep it secure Account, sign-in and security, device Contract; legitimate interests (security)
Give you practice questions, practice tests and a learning path; work out your progress Your goal, your studying Contract
Know whether your subscription is active, and unlock what it includes Subscription Contract
Send emails and push notifications (sign-in codes, security notices, reminders you turn on) Contact details, device token Contract; legitimate interests (security)
Send the weekly progress email to a parent or guardian you invited, after they confirm Your studying, your goal, your first name; their email Consent (yours and theirs; either can stop it)
Help you when you contact us Support, account Contract; legitimate interests (support)
Prevent fraud and abuse: rate limits, new-country checks Sign-in and security, logs Legitimate interests; legal obligation
Keep accounting and tax records; answer authorities Subscription Legal obligation
Improve the Service, find and fix problems Logs, error reports, in-app events (if you agree) Legitimate interests; consent (in-app events)
Send you news about UCSAT (only if you turn it on) Contact details Consent (you can turn it off at any time)

Where we rely on legitimate interests, we've weighed them against your rights; you can object (section 9). We don't make decisions about you based solely on automated processing that have legal or similarly significant effects. Your learning path and the questions we suggest are chosen automatically from your goal and your answers; they only affect what you practise next.

AI. Our team uses AI (Google's Gemini models through Google Cloud Vertex AI, and Anthropic's Claude) to help write, check and translate practice questions, lessons, explanations and their narration. Our team reviews it, and another AI model checks every answer, before students see it. These features don't send your personal information to AI providers. We use the providers' business services under terms that don't allow them to use what we send to train their models.

4. Who we share it with

Our service providers, who process information for us under contract and only on our instructions:

  • Google Cloud (hosting, database, file storage, backups) and Firebase (push notifications, the website);
  • Resend (email) and Twilio (text messages, if you use a phone number);
  • Sentry (error reports);
  • AI providers (Google Vertex AI, Anthropic) for writing and checking study material - without your personal information.

The full, current list is on our Subprocessors page.

Apple and Google. When you subscribe, Apple (App Store) or Google (Google Play) takes your payment and runs your subscription as a controller under its own privacy policy. When you sign in with Apple, Google or Facebook, that company's own privacy policy applies too.

A parent or guardian you invite, only after they confirm by email: a weekly summary of your studying (study time, days studied, lessons finished, questions answered and accuracy, skills going well or needing practice, your SAT date). Never your answers to individual questions, your password or your account details. You can remove them, and they can unsubscribe, at any time.

When the law requires it or to protect people: to comply with the law, a court order or a valid request from authorities; to prevent fraud; or to protect the safety and rights of students, us or others.

If our business changes: if UCSAT is merged, acquired or sold, your information may move to the new owner, who must keep honouring this policy.

We don't sell your personal information and don't share it for targeted advertising. We don't share your results with schools, colleges or the College Board.

5. International transfers

We host the Service in the United States (Google Cloud us-central1, Iowa; files in Google Cloud's US multi-region). Our service providers may process information in the United States and other countries.

Where the law requires it (for example for information from the EEA, UK or Switzerland), we protect transfers with recognised safeguards such as the European Commission's Standard Contractual Clauses with our service providers.

6. How long we keep it

Information How long
Account (name, email, phone, photo) Until you delete your account. Deletion signs you out everywhere and clears your email and phone at once; the rest is erased within 30 days
Your goal and your studying Until you delete your account
Subscription records 7 years after the purchase, as tax and accounting law requires
Support conversations 2 years after the conversation ends
Sessions and sign-in records 180 days after the session ends (sign-in history); failed sign-in attempts 90 days
Server logs and error reports 30 days
Record of the Terms and Privacy Policy you accepted As long as needed to show what you agreed to

We may keep information longer if the law requires it, or to resolve a dispute or a fraud investigation.

7. Security

We protect your information with encryption in transit (HTTPS) and at rest, extra encryption of fields such as email addresses and phone numbers, hashed passwords and one-time codes, rate limits and alerts on sign-in, optional two-step sign-in, and access limited to staff who need it. No system is perfectly secure; if a breach affects your information, we'll tell you and the authorities as the law requires.

8. Your choices

  • Profile: see and change your name, email, phone and photo in the app.
  • Notifications: choose which notifications you get in the app. Security alerts and essential emails are always sent, because they're part of the service.
  • In-app events: turn them on or off in the app.
  • Face ID and notifications: turn them off in the app or in your phone's settings.
  • Sessions: see where you're signed in and sign out any device.
  • Subscription: manage or cancel it in your App Store or Google Play account. Deleting your account doesn't cancel it - cancel it there first.
  • Delete your account: in the app (Profile → Delete account), or by email - see Delete your account. Deletion is final.

9. Your rights

Depending on where you live, you may have the right to:

  • access your personal information and get a copy of it, in a portable format;
  • correct it;
  • delete it;
  • object to, or ask us to restrict, how we use it (including for direct marketing, at any time);
  • withdraw your consent, where we rely on consent (this doesn't affect what we did before);
  • complain to your data protection authority. In the EEA you can find yours on the EDPB website; in the UK, it's the ICO.

To use your rights, write to privacy@ucsat.com from the email address on your account. We may need to confirm it's you. We'll answer within the time the law sets, usually one month (45 days in California). We won't treat you differently for using your rights.

US state privacy rights (including California). We collect the categories of information described in section 2 (identifiers, commercial information such as your subscription, internet activity, education-related information such as your practice answers and results, and photos you upload), for the purposes in section 3, from the sources in section 2, and disclose them for business purposes to the recipients in section 4. We don't sell or share personal information for cross-context behavioural advertising, and haven't in the past 12 months. We use sensitive information (your sign-in credentials) only to provide and secure the Service. You can use your rights to know, access, correct and delete by emailing privacy@ucsat.com; an authorised agent can act for you with your permission.

10. Students under 18

You must be at least 13 to have a UCSAT account. We don't knowingly collect information from children under 13; if we learn that we have, we delete it. If you're under 18 (or the age of majority where you live), use UCSAT with your parent's or guardian's permission. If you think a child under 13 has given us information, contact privacy@ucsat.com and we'll delete it.

11. Changes to this policy

We'll post changes on this page and update the date at the top. If a change is important, we'll tell you in the app or by email before it takes effect.

12. Contact

Clevers LLC